CVE-2026-72497

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-72497", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-09T03:40:39.937Z", "datePublished": "2026-08-15T05:57:30.386Z", "dateUpdated": "2026-10-21T12:45:05.370Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:45:05.370Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/bnxt_re: Add a max slot check for SQ\n\nThe variable WQE mode must be validated against\nthe maximum slots supported by HW. The max supported\nvalue is 64K. Adding a max and min check and fail if user\nsupplied value is more than the max supported and zero."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The flaw is reached only via local RDMA uverbs ioctl/write on /dev/infiniband/uverbs* (IB_USER_VERBS_CMD_CREATE_QP \u2192 bnxt_re_create_qp \u2192 bnxt_re_init_qp_attr); remote RoCE peers cannot supply the bnxt_re_qp_req.sq_slots field.\nAC:L - On bnxt_re hardware with variable WQE enabled, an attacker deterministically sets sq_slots to 0 or any value above 65536 in create_qp driver udata; no race, timing window, or uncontrollable memory layout is required beyond opening uverbs and issuing the ioctl.\nPR:L - Exploitation requires only local access to the world-accessible (mode 0666) uverbs character device to alloc a VAR_WQE ucontext and create a QP; no CAP_SYS_ADMIN, init-namespace root, or other elevated capability is needed on typical HPC/cloud RDMA hosts.\nUI:N - The attacker triggers the bug entirely through their own alloc_context/create_qp sequence with crafted sq_slots; no cooperative action by another user, administrator, or victim is required.\nS:C - On Kubernetes/HPC hosts that expose bnxt_re to unprivileged RDMA workloads or containers, corrupting host-kernel memory or NIC DMA state from a tenant create_qp escapes the workload security boundary to the hypervisor/host authority.\nC:H - Unvalidated sq_slots drives integer overflow in SQ/PSN byte sizing and can register undersized ib_umem while programming firmware with a far larger sq_size, enabling out-of-bounds DMA reads and kernel memory disclosure beyond the mapped queue buffer.\nI:H - Oversized sq_slots values program hardware queue depth beyond the registered user buffer and corrupt queue/PSN metadata sizing, yielding out-of-bounds writes and exploitable memory corruption rather than a benign error return.\nA:H - Invalid zero or >64K slot counts can kernel-oops during QP setup (e.g., inconsistent HWQ/PSN allocation) and misprogrammed queue depths can panic or hang the host when the adapter accesses nonexistent queue memory."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/infiniband/hw/bnxt_re/ib_verbs.c", "drivers/infiniband/hw/bnxt_re/qplib_sp.h"], "versions": [{"version": "d8ea645d6984c84a87032063a0941f15a323831f", "lessThan": "d4d1c78b56b6abc0dcb6015faaed2cf4d0f2797b", "status": "affected", "versionType": "git"}, {"version": "d8ea645d6984c84a87032063a0941f15a323831f", "lessThan": "2106c337905d7445d75818e36920b63f9211c584", "status": "affected", "versionType": "git"}, {"version": "d8ea645d6984c84a87032063a0941f15a323831f", "lessThan": "a59d815cbe667929b693b5fa6716a074e6a31c5b", "status": "affected", "versionType": "git"}, {"version": "d8ea645d6984c84a87032063a0941f15a323831f", "lessThan": "dc95931b7e1326dacae547874bf38c092e5960d8", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/infiniband/hw/bnxt_re/ib_verbs.c", "drivers/infiniband/hw/bnxt_re/qplib_sp.h"], "versions": [{"version": "6.12", "status": "affected"}, {"version": "0", "lessThan": "6.12", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.114", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.57", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.12.114"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.18.57"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/d4d1c78b56b6abc0dcb6015faaed2cf4d0f2797b"}, {"url": "https://git.kernel.org/stable/c/2106c337905d7445d75818e36920b63f9211c584"}, {"url": "https://git.kernel.org/stable/c/a59d815cbe667929b693b5fa6716a074e6a31c5b"}, {"url": "https://git.kernel.org/stable/c/dc95931b7e1326dacae547874bf38c092e5960d8"}], "title": "RDMA/bnxt_re: Add a max slot check for SQ", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-72497", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T18:51:09.318750Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T18:55:27.288Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-72497", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T18:51:09.318750Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T18:51:10.555Z"}}], "cna": {"title": "RDMA/bnxt_re: Add a max slot check for SQ", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The flaw is reached only via local RDMA uverbs ioctl/write on /dev/infiniband/uverbs* (IB_USER_VERBS_CMD_CREATE_QP \u2192 bnxt_re_create_qp \u2192 bnxt_re_init_qp_attr); remote RoCE peers cannot supply the bnxt_re_qp_req.sq_slots field.\nAC:L - On bnxt_re hardware with variable WQE enabled, an attacker deterministically sets sq_slots to 0 or any value above 65536 in create_qp driver udata; no race, timing window, or uncontrollable memory layout is required beyond opening uverbs and issuing the ioctl.\nPR:L - Exploitation requires only local access to the world-accessible (mode 0666) uverbs character device to alloc a VAR_WQE ucontext and create a QP; no CAP_SYS_ADMIN, init-namespace root, or other elevated capability is needed on typical HPC/cloud RDMA hosts.\nUI:N - The attacker triggers the bug entirely through their own alloc_context/create_qp sequence with crafted sq_slots; no cooperative action by another user, administrator, or victim is required.\nS:C - On Kubernetes/HPC hosts that expose bnxt_re to unprivileged RDMA workloads or containers, corrupting host-kernel memory or NIC DMA state from a tenant create_qp escapes the workload security boundary to the hypervisor/host authority.\nC:H - Unvalidated sq_slots drives integer overflow in SQ/PSN byte sizing and can register undersized ib_umem while programming firmware with a far larger sq_size, enabling out-of-bounds DMA reads and kernel memory disclosure beyond the mapped queue buffer.\nI:H - Oversized sq_slots values program hardware queue depth beyond the registered user buffer and corrupt queue/PSN metadata sizing, yielding out-of-bounds writes and exploitable memory corruption rather than a benign error return.\nA:H - Invalid zero or >64K slot counts can kernel-oops during QP setup (e.g., inconsistent HWQ/PSN allocation) and misprogrammed queue depths can panic or hang the host when the adapter accesses nonexistent queue memory."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "d8ea645d6984c84a87032063a0941f15a323831f", "lessThan": "d4d1c78b56b6abc0dcb6015faaed2cf4d0f2797b", "versionType": "git"}, {"status": "affected", "version": "d8ea645d6984c84a87032063a0941f15a323831f", "lessThan": "2106c337905d7445d75818e36920b63f9211c584", "versionType": "git"}, {"status": "affected", "version": "d8ea645d6984c84a87032063a0941f15a323831f", "lessThan": "a59d815cbe667929b693b5fa6716a074e6a31c5b", "versionType": "git"}, {"status": "affected", "version": "d8ea645d6984c84a87032063a0941f15a323831f", "lessThan": "dc95931b7e1326dacae547874bf38c092e5960d8", "versionType": "git"}], "programFiles": ["drivers/infiniband/hw/bnxt_re/ib_verbs.c", "drivers/infiniband/hw/bnxt_re/qplib_sp.h"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.12"}, {"status": "unaffected", "version": "0", "lessThan": "6.12", "versionType": "semver"}, {"status": "unaffected", "version": "6.12.114", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.57", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.5", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/infiniband/hw/bnxt_re/ib_verbs.c", "drivers/infiniband/hw/bnxt_re/qplib_sp.h"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/d4d1c78b56b6abc0dcb6015faaed2cf4d0f2797b"}, {"url": "https://git.kernel.org/stable/c/2106c337905d7445d75818e36920b63f9211c584"}, {"url": "https://git.kernel.org/stable/c/a59d815cbe667929b693b5fa6716a074e6a31c5b"}, {"url": "https://git.kernel.org/stable/c/dc95931b7e1326dacae547874bf38c092e5960d8"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/bnxt_re: Add a max slot check for SQ\n\nThe variable WQE mode must be validated against\nthe maximum slots supported by HW. The max supported\nvalue is 64K. Adding a max and min check and fail if user\nsupplied value is more than the max supported and zero."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.114", "versionStartIncluding": "6.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.57", "versionStartIncluding": "6.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1.5", "versionStartIncluding": "6.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2", "versionStartIncluding": "6.12"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:45:05.370Z"}}}, "cveMetadata": {"cveId": "CVE-2026-72497", "state": "PUBLISHED", "dateUpdated": "2026-10-21T12:45:05.370Z", "dateReserved": "2026-08-09T03:40:39.937Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-08-15T05:57:30.386Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/infiniband/hw/bnxt_re/ib_verbs.c", "drivers/infiniband/hw/bnxt_re/qplib_sp.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "d4d1c78b56b6abc0dcb6015faaed2cf4d0f2797b", "status": "affected", "version": "d8ea645d6984c84a87032063a0941f15a323831f", "versionType": "git"}, {"lessThan": "2106c337905d7445d75818e36920b63f9211c584", "status": "affected", "version": "d8ea645d6984c84a87032063a0941f15a323831f", "versionType": "git"}, {"lessThan": "a59d815cbe667929b693b5fa6716a074e6a31c5b", "status": "affected", "version": "d8ea645d6984c84a87032063a0941f15a323831f", "versionType": "git"}, {"lessThan": "dc95931b7e1326dacae547874bf38c092e5960d8", "status": "affected", "version": "d8ea645d6984c84a87032063a0941f15a323831f", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/infiniband/hw/bnxt_re/ib_verbs.c", "drivers/infiniband/hw/bnxt_re/qplib_sp.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.12"}, {"lessThan": "6.12", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.114", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.57", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/bnxt_re: Add a max slot check for SQ\n\nThe variable WQE mode must be validated against\nthe maximum slots supported by HW. The max supported\nvalue is 64K. Adding a max and min check and fail if user\nsupplied value is more than the max supported and zero."}], "id": "CVE-2026-72497", "lastModified": "2026-10-21T13:19:39.483", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.0, "impactScore": 6.0, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-72497", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T18:51:09.318750Z", "version": "2.0.3"}}]}, "published": "2026-08-15T06:22:24.037", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2106c337905d7445d75818e36920b63f9211c584"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a59d815cbe667929b693b5fa6716a074e6a31c5b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d4d1c78b56b6abc0dcb6015faaed2cf4d0f2797b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/dc95931b7e1326dacae547874bf38c092e5960d8"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: RDMA/bnxt_re: Add a max slot check for SQ", "id": "2516797", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516797"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-805", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nRDMA/bnxt_re: Add a max slot check for SQ\nThe variable WQE mode must be validated against\nthe maximum slots supported by HW. The max supported\nvalue is 64K. Adding a max and min check and fail if user\nsupplied value is more than the max supported and zero.", "A flaw was found in the RDMA/bnxt_re component of the Linux kernel. This vulnerability arises from insufficient validation of the Work Queue Entry (WQE) mode, which dictates how tasks are managed, against the hardware's defined slot limits. A local attacker could exploit this by supplying an invalid WQE mode value, potentially causing unexpected system behavior or a denial of service (DoS)."], "name": "CVE-2026-72497", "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-72497\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-72497\nhttps://lore.kernel.org/linux-cve-announce/2026081540-CVE-2026-72497-ea51@gregkh/T"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d8ea645d6984c84a87032063a0941f15a323831f,a59d815cbe667929b693b5fa6716a074e6a31c5b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d8ea645d6984c84a87032063a0941f15a323831f,dc95931b7e1326dacae547874bf38c092e5960d8)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.12"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.12)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.5,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-15T17:15:03.022163+00:00", "updated": "2026-08-22T04:00:12.156292+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}